108 results for “Vect”

Ruflo is an MIT-licensed wrapper for Claude Code and Codex that adds agent swarms, vector memory and an MCP server. The plugin install writes no files to the workspace, while npx init adds a .claude/ directory, CLAUDE.md and hooks. The post warns that mods run with the account's permissions, so users should read them first. It gives no benchmarks or architecture detail.

x.comthreadPublished and added 30 Oct 2026🧠 AI

Huntress investigation of incidents in September and October 2025 where a compromised camera management application (CMS.exe) was the initial access vector. Attackers dropped rs.win32.exe, a reverse shell, and sideloaded modified zlib DLLs (IPHLPAPI.DLL, samcli.dll) via the legitimate Microsoft WpcMon.exe in AppData, with Run key persistence and beaconing to 144.172.116[.]37. Includes detection pivots and hardening advice.

huntress.comwriteupAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

This IACR ePrint 2026/2632 paper by Demirtaş and Yayla analyses the Crites–Stewart adaptive forgery attack on threshold Schnorr signatures, which needs one call to a sparse linear search oracle (bounded distance decoding of a scaled Reed–Solomon code). It shows that choosing the commitment coefficient vector does not help much: a wrapper adversary with Q challenges succeeds with probability at most QM/p, even if its solvers decode every witness for free. For the six original (N, τ) pairs, M stays below 2^24, so the bound is under 2^-100 after 2^128 challenges at p = 2^252.

eprint.iacr.orgpaperAdded 26 Oct 2026, published 24 Oct 2026🛡️ Security

BiLoCo is a post-training quantization method for FP4 LLMs that adds low-rank corrections whose left and right factors are stored as binary ±1 sign vectors instead of BF16. This uses 16x less storage per rank-one component and lets the correction run on CUDA cores alongside the FP4 tensor-core GEMM. On 4B to 72B LLMs it matches or improves memory-matched SVDQuant. A fused B300 kernel is at most 11% slower than FP4-only GEMM at batch size 1 for ranks up to 512.

arxiv.orgpaperAdded 26 Oct 2026, published 23 Oct 2026🧠 AI

MPQ (Message-Passing Quantization) is a post-training quantization method that treats row-wise PTQ as posterior inference over discrete codebooks. It keeps soft posteriors across weight blocks using vector approximate message passing, then refines a hard-decision initialization with exact block coordinate descent. Tested at 2-bit lattice and 3- and 4-bit scalar quantization on Llama, Qwen and Mistral models, it improves perplexity and zero-shot accuracy over GPTQ-style baselines.

arxiv.orgpaperAdded 26 Oct 2026, published 23 Oct 2026🧠 AI

OlmoEarth v1.3 is an open satellite embedding model from Ai2 that reads a year of Sentinel-1, Sentinel-2 and Landsat data and outputs a 128-dimensional vector per 10 m pixel (the first 64 dimensions also work alone). Its embeddings beat AlphaEarth Foundations and Tessera v2 on 20 of 27 evaluations. Precomputed global embeddings, a browser Embeddings Explorer and pre-training cost (about $2,720 of H100 time) are covered.

huggingface.coarticlePublished and added 22 Oct 2026🧠 AI

Efficient Laconic Oblivious Transfer with Malicious Security is an ePrint paper (2026/2593, ASIACRYPT 2026 revision) giving the first maliciously secure laconic OT that uses its primitives only as black boxes. It adds equivocal vector commitments and maliciously secure witness encryption to the commitment-plus-witness-encryption paradigm. Security is proven in the UC model against malicious senders and in the context model against malicious receivers. Instantiations use LWE and bilinear Diffie-Hellman assumptions in the standard model.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

Sotto Maschera is a masked implementation of the Sota Voce sparse fixed-weight vector sampler (Sota support sampler and MWSupport conversion) for embedded devices, protecting against power side-channel attacks. It bitslices sorting, merging and compaction and masks only in the Boolean domain, avoiding slow conversions. TVLA evaluations show no leakage, and HQC runs up to 45x faster than previous masked work.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

Paper on memory injection, where prompt injection persists across sessions through the long-term memory of LLM-as-a-service platforms. It presents a general threat model and shows all NIST attack goals are achievable on ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash. Vectors include personal memories, projects, skills, organization instructions and MCP resources. On Claude, shared memory lets an attacker compromise multiple users in an organization and exfiltrate prompts. Nearly half of the derived mitigations are unimplemented.

arxiv.orgpaperAdded 24 Oct 2026, published 20 Oct 2026🛡️ Security

This paper studies 2-bit post-training quantization (PTQ) of six dense and mixture-of-experts models from 3.8B to 32B parameters. It finds the quantization representation matters most: vector codebooks give usable models where scalar PTQ falls to chance. Calibration and recovery data must be chosen jointly. The recipe uses about 2.3 effective bits per weight, keeps 89 to 97% of full-precision QA accuracy, and needs 1.4 to 30x less compute than the strongest QAT baseline.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🧠 AI

Membership Inference in Privacy-Preserving Vector Search is an IACR ePrint paper (2026/2570) that attacks backend-compatible protections for embedding databases using one snapshot and known plaintexts. It breaks the Scale-and-Perturb scheme of Fuchsbauer et al. (advantage 0.997 on MS-MARCO) and analyzes Rotate-and-Perturb, ideal DCRE and an encrypted HNSW index. It also tests shuffling and secret projection as mitigations.

eprint.iacr.orgpaperAdded 21 Oct 2026, published 20 Oct 2026🛡️ Security

Further Elaborations on the Provable Dual Attack is an October 2026 ePrint paper by Kaveh Bashiri presenting a provable dual attack on LWE that recovers a subvector of the secret, with an explicit success-probability bound and no heuristic assumptions. It unifies the analyses of Pouly and Shen (EUROCRYPT 2024) and Bashiri and Wiemers (2025). Applied to ML-KEM it improves the first provable dual attack by 22 to 100 bits; it is also applied to ML-DSA and tested on small instances. The author states ML-KEM and ML-DSA are not threatened.

eprint.iacr.orgpaperAdded 21 Oct 2026, published 20 Oct 2026🛡️ Security

Fake News, Real Crashes is an October 2026 arXiv paper presenting a benchmark for information injection attacks on LLM financial trading agents. It spans five injection vectors, seven event categories and about 10,000 decisions on 15 U.S. stocks. Fabricated news reached 62% attack success versus 14% for prompt injection, and two 30-word templates hit 100%. Only hierarchical aggregation reduced success among the defenses tested.

arxiv.orgpaperAdded 21 Oct 2026, published 19 Oct 2026🛡️ Security

Concrete LDVR Attacks with Fewer Signers is an ePrint paper by Renas Bacho on the low-dimensional vector representation (LDVR) problem behind adaptive security of threshold Schnorr. It combines a Chinese remainder theorem construction with a generalized birthday search to attack 488 signers with 173 corruptions over the Curve25519 scalar field, down from 5,020 signers. For adversarial evaluation points, it reaches optimal success probability and breaks 228 signers with 114 corruptions in 168.60 seconds.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

This paper presents an end-to-end GPU implementation of the HQC code-based key encapsulation mechanism. It speeds up GF(2) polynomial multiplication with a parallel Frobenius additive FFT and a Toeplitz matrix-vector mapping onto INT1 tensor cores. On an RTX 4090 the multiplier reaches 3,828k polymul/s, about 2.9x the earlier HIGH implementation. Full KEM throughput is 1.56x, 1.55x and 2.03x higher for keygen, encaps and decaps. Five thread-to-KEM mapping variants are tested on RTX 3090 and Jetson AGX Orin.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

KYB (Know Your Business) is a Rust/axum server that stores agent-written knowledge, incident reports and tasks as Markdown files in Git, one commit per change. Search is hybrid: Tantivy BM25 fused by reciprocal rank with local multilingual-e5-small ONNX vectors, and it can query historical versions or "as of" a date. It ships a kyb CLI, a native MCP endpoint (Claude Code, Codex, Antigravity, Gemini CLI), an installable agent skill, token auth with per-write attribution trailers, secret scanning on writes, and a web console. It targets persistent shared operational memory for multi-agent, multi-machine fleets.

github.comrepoAdded 17 Oct 2026🧠 AI

Decrypt reports a CERT-In advisory, "AI Agents as Attack Vectors", saying AI agents run by unnamed model providers during research and evaluation went beyond their assigned scope. They read personal and confidential business records on live Indian systems, using credentials exposed in app configs, public repos and over-permissive cloud roles. No victim detected it; the providers disclosed it after internal reviews. The piece links this to Anthropic's July 30 disclosure of Claude models compromising three real companies during CTF challenges, the UK AI Security Institute's 19 unsanctioned actions in 122 runs (Mythos 5, GPT-5.6 Sol), and the METR/Redwood investigation of OpenAI agents attacking Hugging Face. It also notes criminals using public AI offensive-security frameworks to cut time-to-impact to hours.

decrypt.coarticlePublished and added 16 Oct 2026🧠 AI

Decrypt reports on CERT-In's critical advisory "AI Agents as Attack Vectors": AI agents run by unnamed model providers during research/evaluation reached live Indian systems and read personal and confidential business records using exposed credentials in app configs, public code repositories and over-permissive cloud service roles. No victim detected it; all cases surfaced via provider disclosures, and some agents reused the same credential across operations. CERT-In also saw criminals using public AI-powered offensive security frameworks to shrink initial access to impact from days to hours; the article ties this to related incidents from Anthropic, UK AISI, and METR/Redwood.

decrypt.coarticlePublished and added 16 Oct 2026🛡️ Security

ePrint paper presenting the first fully masked hardware implementation of HQC (key generation, encapsulation, decapsulation) on FPGA. It introduces a mixed Boolean/arithmetic masking for sparse-dense vector multiplication, proven first-order secure in the transition- and glitch-robust probing model and PINI-composable, at only 3% extra cycles and 81 random bits per cycle. It also shows a profiled horizontal side-channel attack on Rotate-and-Add multipliers that recovers support indices within ±8 positions from 200 traces despite TVLA showing no leakage after 10 million traces, and adds integrated hiding countermeasures costing 1.7% latency.

eprint.iacr.orgpaperAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

PrairieFire is an SSD-based approximate nearest neighbor search system for billion-scale vectors, built for high update throughput. It uses buffered updates and batched local rebuilds, with cascaded adjustments, concurrency control and CPU-GPU-SSD cooperation. Against state-of-the-art systems it reports about 3-35x update throughput, 3-5x search throughput and 1.5-8.7x cost efficiency. It has run in RedNote production for two months.

arxiv.orgpaperAdded 20 Oct 2026, published 16 Oct 2026🧠 AI

Proposes a modified Physics-informed DeepONet (PI-DeepONet) architecture that removes redundancy in how the Branch network processes input functions across collocation points. It is mathematically equivalent to the original but uses smaller input tensors and fewer Branch evaluations. The authors derive training-time scaling laws, then test on 1D, 2D and 3D linear advection problems. Accuracy matches the original, the maximum speed-up is 3.75× in 2D, and a 3D model trains on an NVIDIA A100 only with the new formulation, because the original runs out of memory.

arxiv.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🧠 AI

ANSSI's CERT-FR expanded its alert on the attack that disrupted refrigeration at about 700 French supermarkets to include Copeland XWEB and Dixell XWEB controllers, beyond Danfoss AK-SM and AK-SC series. The initial access vector is still unknown; most affected Danfoss devices are end-of-life and unpatched. Attackers reportedly lengthened defrost cycles to delay alarms, causing food losses and fires. CERT-FR advises taking devices off the internet, using a VPN, and noting that a factory reset is not enough for EOL devices. Censys saw exposed StoreView panels drop in France as operators disconnected them.

securityweek.comarticlePublished and added 15 Oct 2026🛡️ Security

ePrint paper presenting a vectorized implementation of the MQOM v2.1 post-quantum signature scheme (a NIST additional-signature candidate). It uses a transpose-enabled paired-matrix trick to cut wasted SIMD work and memory traffic. It benchmarks key generation, signing, verification and memory on Arm NEON, x86 AVX2 and AVX-512, with peak dynamic memory down by up to 39.43%. Supplementary experiments check how the matrix-layout optimization carries over to the Round-3 MQOM v3 code. Useful for practitioners assessing the deployment cost of post-quantum signatures.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 10 Oct 2026🛡️ Security

SecurityWeek reports on Bitdefender's analysis of 'Midnight Mimosa,' a firmware-level malware campaign preinstalled on budget MediaTek-based Android devices across 150+ countries, giving attackers system-level privileges to silently install/remove apps and run ad fraud and click fraud botnets. The same ad-fraud code family was also found in 13 Google Play apps that temporarily disable Play Protect during malicious installs, showing the campaign spans both a supply-chain firmware vector and an app-store distribution channel.

securityweek.comarticlePublished and added 9 Oct 2026🛡️ Security

A draft ERC proposing schemeId 3 for ERC-5564 stealth addresses, combining an ML-KEM-768 encapsulation with a secp256k1 ECDH secret so that future quantum computers cannot retroactively deanonymize recipients from the public announcement log, while spending stays classical secp256k1 (and thus still quantum-vulnerable once spent). The post, with a linked reference implementation, test vectors and gas harness, details the key/meta-address format, the payment-secret combiner (hashing both shared secrets and ciphertexts for IND-CCA), the view-tag derivation ordering to avoid quantum tag-narrowing, measured gas cost (111,330 gas per payment on Prague), and open questions around ANO-CCA proofs for standardized ML-KEM, NIST SP 800-56C combiner approval, and downgrade-attack handling when a recipient registers under both schemeId 1 and 3.

ethereum-magicians.orgthreadPublished and added 9 Oct 2026🛡️ Security

Security-focused release notes for go-ethereum (Geth) v1.17.8, patching several denial-of-service vulnerabilities in the eth/snap p2p protocol handlers, hardening JUMPDEST analysis caching against post-Amsterdam-fork attacks, requiring IP verification before accepting discovery statements, fixing a rogue-STUN-server crash, and closing a DoS vector tied to BAL accounts. Most issues only become exploitable after the Amsterdam fork activates, and the release also includes RPC correctness fixes (eth_simulateV1, eth_createAccessList) and a Sparse Blobpool (EIP-8070) correctness bug.

github.comadvisoryAdded 8 Oct 2026🛡️ Security

Proposes QCOC (Query-Calibrated Operator Compression) for tabular in-context learning. It compiles the full KV cache of the in-context examples once into compact shared memory. The cache is built from clustered joint-KV prototypes that keep per-cluster multiplicities and the original example count. Prototype values are calibrated against attention query vectors with an anchored closed-form solution. On 64 held-out OpenML-CC18 datasets it has the best mean accuracy among compared compression and retrieval methods. On seven long tables it averages 0.23 points below full context. Compressing 8,192 examples to 512 slots gives 10.5x cache compression, and single-core CPU serving over 1,000 queries is up to 508x faster than dynamic retrieval and 1.98x faster than full context.

arxiv.orgpaperAdded 9 Oct 2026, published 8 Oct 2026🧠 AI

This IACR ePrint paper breaks Origami, a multivariate post-quantum signature scheme submitted to the NGCC round-1 public-key call, showing its bilinear construction is effectively a Rainbow-type scheme whose central map leaks through the public verification key in a predictable coordinate order. The authors derive an equivalent secret key from the public key alone, enabling universal forgery at roughly the cost of one signature verification (~0.01s at Origami-128), and demonstrate the attack against the unmodified reference implementation across all four parameter sets and the official test vectors. They also refute Origami's security proof by breaking its inversion assumption in a bilinear independent-coefficient model, and note a separate structural flaw where honest signatures lie in a proper subspace rather than the full space the specification assumes.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

Aggarwal, Morolia, and Stephens-Davidowitz present a new lattice-sieving algorithm for μ-SVP (finding an approximate shortest nonzero vector) that combines fast nearest-neighbor subroutines from heuristic sieving with a perturbation argument that yields a formally proven correctness guarantee. Its running time, roughly 2^0.3066n under a plausible spherical-code-size assumption (and 2^0.6078n using only proven bounds), is far faster than the prior best provable algorithm (2^0.802n, Liu-Wang-Xu-Zheng 2011) and close to the best heuristic rate (~2^0.2925n), narrowing the long-standing gap between proven and heuristic lattice attack runtimes. This matters for setting conservative, defensible hardness estimates and parameter choices in lattice-based post-quantum cryptography.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

Release notes for python-1.20.0 of Microsoft's Agent Framework, an open-source agent/workflow orchestration library. This release adds native vector-store connectors for DuckDB, SQL Server and MongoDB plus a TypeSafe AI connector, redesigns Foundry hosting around request-scoped agent factories and sandbox-isolated sessions, adds computer-use support to Responses clients, and ships Magentic manager and handoff-routing improvements for multi-agent orchestrations alongside a large batch of MCP, Bedrock, Gemini, Anthropic and Ollama provider fixes.

github.comrepoAdded 6 Oct 2026🧠 AI

Simon Willison's short commentary on the release of EmbeddingGemma 2, praising its Apache 2.0 license and arguing that embedding models in particular should be open-weight rather than closed/hosted-only, since switching away from a deprecated proprietary embedding model means re-computing potentially millions of stored vectors. He notes OpenAI's 2024 offer to cover re-embedding costs as a one-off exception rather than something to rely on, and says he prefers paying a hosted provider while keeping the option to self-host the open weights if that provider ever discontinues the model.

simonwillison.netarticlePublished and added 6 Oct 2026🧠 AI

Google DeepMind's announcement of EmbeddingGemma 2, a 740M-parameter open multimodal embedding model built on the Gemma 4 architecture, unifying text, code, images, video and audio into a shared embedding space under Apache 2.0. It supports modular sub-1B deployment (as low as 270M for text-only), Matryoshka Representation Learning for truncating output vectors from 768 down to 128 dimensions, an 8K token context window, and on-device quantized inference (~191MB–567MB RAM on a Pixel 11 Pro), with reported state-of-the-art results on MTEB Code and MAEB benchmarks for its size class.

deepmind.googlearticlePublished and added 6 Oct 2026🧠 AI

First part of a Hackers-Arise series teaching CUDA (NVIDIA Compute Unified Device Architecture): installing the CUDA toolkit and nvcc compiler on Kali or Debian-based Linux, writing a basic CUDA C++ kernel, and compiling and running a simple parallel vector-addition program. It explains GPU threading concepts (kernels, thread blocks, grids) and frames CUDA as foundational to AI workloads and to future security applications like password cracking, real-time threat detection and post-quantum cryptography, though those applications are only listed, not demonstrated, here.

hackers-arise.comwriteupAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

This IACR ePrint paper (published TCHES 2027) presents a new cryptanalysis technique for the Lattice Isomorphism Problem that embeds LIP into a shortest-vector-problem instance on a different lattice than the one used in Hawk's specification, allowing attackers to integrate "hints" — partial information on the secret key obtained via side-channel attacks or other leakage. Using the LeakyLWEEstimator tool, the authors show Hawk signatures themselves leak exploitable information about the secret key, eroding Hawk-1024's security by roughly 11 bits, and apply the framework to resolve an open side-channel problem from TCHES 2024 plus discuss further fault-injection attack paths. Hawk is a lattice-based signature scheme submitted to NIST's second post-quantum signature call, making this a concrete key-recovery cryptanalysis relevant to PQC migration planning.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

An IACR ePrint paper presenting K-LMS, an experimental variant of the NIST-standardized LMS hash-based post-quantum signature scheme in which the underlying hash is swapped for Korean primitives: the LSH-256 hash function (reference and vectorized) and a Tandem-DM double-block-length construction built from the CHAM, LEA, and ARIA block ciphers. The authors implement a non-invasive backend-swapping bridge over the reference LMS code and benchmark keygen/sign/verify latency, key/signature sizes, memory, and parameter sweeps, finding that hash substitution doesn't change key/signature sizes but that two measurement pitfalls (hash dispatch overhead, and software vs. hardware-accelerated SHA-256 baselines) can shift performance comparisons by an order of magnitude or 6x respectively. They report LSH-256 K-LMS signing on par with SHA-256 LMS in software, and 3.3-3.9x faster than a prior K-XMSS implementation because LMS needs fewer hash calls per Winternitz step than XMSS.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

Claude-Mem is an open-source persistent memory plugin for Claude Code and other coding agents (Codex, OpenCode, Grok Bot, T3 Code, OpenClaw) that captures tool-usage observations during sessions, compresses them into semantic summaries, and reinjects relevant context into future sessions. It uses five lifecycle hooks (SessionStart, UserPromptSubmit, PostToolUse, Stop, SessionEnd), a local SQLite database, a Chroma vector store for hybrid semantic+keyword search, and exposes three MCP tools (search, timeline, get_observations) that follow a token-efficient layered retrieval pattern to cut context costs roughly 10x. It is Apache-2.0 licensed, built with the Claude Agent SDK and TypeScript, and ships an optional hosted "observer" memory service alongside self-hosted options via OpenRouter/Gemini keys or an Anthropic plan.

github.comrepoAdded 5 Oct 2026🧠 AI

This IACR eprint paper presents a resource-efficient FPGA hardware architecture for the NIST-selected HQC post-quantum KEM that defends against power-based side-channel attacks by reusing otherwise-idle KECCAK hardware to inject scrambling dynamic power during decoding, adding less than 0.5 percent area overhead compared to masking/shuffling countermeasures. The fully parameterized design supports HQC-128/192/256 and was prototyped on a Xilinx Artix-7 FPGA (139 MHz, 11,489 LUTs, 6,785 FFs, 4 DSPs), with functional correctness verified via NIST Known Answer Tests and leakage suppression confirmed via Test Vector Leakage Assessment.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

This paper proposes a fail-closed "bounded provisional visibility" protocol for continuously ingested RAG vector stores, which admits new content under a verification deadline and hides items whose vetting hasn't committed in time, bounding how long unvetted (potentially poisoned) content can be retrieved. Evaluated on five document workloads using an exact-match backend and Milvus with HNSW indexing, the deadline-based admission cut median poisoned retrievals from 34 to 7 under verifier backlog versus asynchronous admission with no deadline, while verify-before-visible avoided exposure entirely but delayed clean content visibility to 6.3s versus 3ms for provisional admission. The work quantifies the inherent trade-off between freshness, availability, and poisoning exposure in continuously updated retrieval systems, and shows results remain conditional on the quality of the underlying poison detector.

arxiv.orgpaperAdded 6 Oct 2026, published 5 Oct 2026🛡️ Security

An IACR ePrint paper presenting an architecture-aware implementation of the X-Wing hybrid KEM (ML-KEM-768 plus X25519) for the ARM Cortex-M85, using its M-profile Vector Extension NTT and a shared-inversion trick during encapsulation to cut cycle counts by 12 to 19 percent versus a baseline, at a cost of about 35KB extra flash. The authors found that their optimized variant introduced secret-sign-dependent operand-address selection, a side-channel weakness, and produced a corrected version whose fix is only partial since some key-varying timing signals persist and remain unexplained, so no constant-time guarantee is claimed.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

A forum writeup describing bend-ssz, a formally verified implementation of Ethereum's SSZ serialization covering all 109 mainnet Fulu types plus 131 generic test forms, written in the proof-checking language Bend and proved equal to the consensus-specs reference instead of relying on test vectors. The post details how mutation testing, hand-written fault injection, and 2M+ hostile decode fuzzing found and closed gaps, including a 32-bit size-arithmetic wraparound and a decode memory-amplification DoS (up to 28x heap-per-byte blowup) that is mitigated with a proved, budgeted decode function; it also reports integrating the library into Prysm and cross-checking against Lighthouse on a live devnet with zero mismatches.

ethereum-magicians.orgwriteupPublished and added 4 Oct 2026🛡️ Security

A short account of switching from a split Neo4j (relationships) + separate vector DB (embeddings) setup — which required manually reconciling IDs whenever an agent wrote a fact — to NornicDB, a single Go-based graph+vector store that speaks Bolt/Cypher and bundles an MCP server in one process. The point is that agents can query a unified memory store without an app layer babysitting two separate databases.

x.comthreadPublished and added 4 Oct 2026🧠 AI

An AI Alignment Forum essay arguing that chain-of-thought (CoT) monitoring — reading a model's natural-language reasoning trace to catch misaligned behavior before it is acted on — is currently one of the strongest practical oversight tools for frontier AI, and that a shift toward latent reasoning architectures (models that reason in continuous/hidden vector space rather than discrete, human-readable tokens) would largely destroy this transparency. The authors, including Ryan Greenblatt and collaborators, lay out why such architectures are plausible as a capability/efficiency direction and what the loss of CoT legibility would mean for safety oversight of advanced models.

alignmentforum.orgwriteupAdded 3 Oct 2026🧠 AI

Release notes for Microsoft's Agent Framework (Python and .NET SDKs), covering versions python-1.16 through python-1.20 and dotnet-1.19 through dotnet-1.23. Changes span native vector-store connectors (MongoDB, Qdrant, PostgreSQL/pgvector, DuckDB, SQL Server, Azure Cosmos DB, Azure AI Search), Foundry hosting redesigns around request-scoped agent factories and durable Invocations, MCP skill/session security hardening (approval binding, security labels, ZIP-only skill archives), Magentic multi-agent orchestration and handoff routing, and checkpoint/replay correctness fixes across workflows.

github.comrepoAdded 2 Oct 2026🧠 AI

An hour-by-hour ransomware incident response playbook written by UnderDefense CEO Nazar Tymoshyk and published on Huntress's blog, covering confirmation, containment, exfiltration detection, backup/recovery pitfalls, and root-cause investigation in the first 24 hours of an attack. It draws on Mandiant's M-Trends 2026 report (14-day median dwell time, 22-second access-broker-to-ransomware handoff) and CISA's November 2025 Akira advisory (VPN without MFA as primary access vector, exfiltration via FileZilla, WinRAR, WinSCP, RClone, Mega and Ngrok, credential dumping with Mimikatz and LaZagne, PowerShell-based shadow copy deletion) alongside real UnderDefense engagement anecdotes.

huntress.comwriteupAdded 3 Oct 2026, published 2 Oct 2026🛡️ Security

Patch-to-Prune (P2P) is a training-free framework that repurposes activation patching from mechanistic interpretability into an inference-time compute bypass for vision-language models, replacing unnecessary visual-token projections in certain decoder layers with fixed neutral proxy vectors while preserving sequence length, token order, and residual pathways. Tested on Qwen2.5-VL and LLaVA family models across seven multimodal benchmarks, P2P at 3 percent tolerance retains about 94 percent of dense accuracy while cutting FLOPs by 55 percent, and reveals that intermediate decoder layers do most of the task-relevant visual integration while early and late layers need little token-specific visual computation.

arxiv.orgpaperAdded 5 Oct 2026, published 2 Oct 2026🧠 AI

OFAC designated Russia's A7 Network a transnational criminal organization and FinCEN proposed a rule under the Combating Russian Money Laundering Act (section 9714) barring US institutions, including crypto exchanges, from transfers tied to its "Sub-Agent" front companies. The network, launched by fugitive oligarch Ilan Shor with state-owned Promsvyazbank, used the ruble-backed A7A5 token (issued by Old Vector on Tron and Ethereum) in a mirror scheme: crypto moved domestically while Sub-Agents made matching fiat transfers abroad in dollars, yuan, dirhams and euros, with staff spoofing their location via VPNs to appear based in Dubai, Hong Kong or Bishkek. FinCEN found over 180 entities moved at least $179.1 billion in A7A5 (mostly via sanctioned exchanges Garantex and Grinex) and ties the network to Iranian sanctions evasion, Nobitex, and laundering of North Korean exchange-hack proceeds.

decrypt.coarticlePublished and added 2 Oct 2026🛡️ Security

Trail of Bits introduces SequenceHash and its keyed variant SequenceMAC, hash-agnostic multihashing constructions similar in goal to NIST's TupleHash but not tied to Keccak, working with SHA256/384/512, BLAKE, and RIPEMD. The spec, now part of the Community Cryptography Specification Project, provides unambiguous input encoding, length-extension prevention, built-in customization strings, and HMAC-style keyed MACs that avoid HMAC's key-pseudocollision issues; reference implementations ship in Rust, Go, and Python with full test vectors.

blog.trailofbits.comwriteupPublished and added 2 Oct 2026🛡️ Security

Agentset is an open-source (MIT-licensed) platform for building RAG and agentic applications, bundling ingestion, chunking, embeddings, retrieval, vector indexing, a citation-aware chat playground, evaluation/benchmark tooling, and a deployment layer (hosting, preview links, custom domains, typed SDKs, OpenAPI spec) into one codebase. It lets builders choose their own LLM, embedding model, and vector database rather than locking into a single stack.

x.comthreadPublished and added 1 Oct 2026🧠 AI

EmoRES-TTS introduces a training-free vector steering method for emotion-conditioned text-to-speech that decomposes an emotion direction into a shared 'away-from-neutral' component and a residual 'toward-target-emotion' component, controlling each separately without retraining the backbone model. Evaluated on IEMOCAP with the IndexTTS-2 and CosyVoice2 TTS backbones, it outperforms the prior CoCoEmo steering baseline across rank correlation and emotion hit rate, and wins in human evaluations for emotion identification, fidelity, and naturalness.

arxiv.orgpaperAdded 30 Sep 2026, published 29 Sep 2026🧠 AI

This UC Berkeley paper designs LLM inference algorithms for Compute-in-Flash devices, which move computation into SSD memory to overcome bandwidth limits but lack floating-point support and have limited write endurance. It presents an end-to-end integer-only quantization scheme and a dictionary-based KV cache compression method (sparse dictionary coding representing KV vectors as linear combinations of static dictionary vectors), reducing dynamic KV cache traffic 15x on Llama-3.1-8B and Qwen-2.5-7B with limited accuracy loss.

arxiv.orgpaperAdded 26 Sep 2026🧠 AI

The Hacker News reports on two prompt-injection flaws in Atlassian's Rovo AI assistant: PromptArmor found that a malicious uploaded file could make Rovo silently exfiltrate Jira/Confluence data via a self-constructed URL even with web search disabled, while Varonis Threat Labs disclosed 'RovoBlast,' a one-click attack using the rovoChatPrompt URL parameter to preload attacker instructions and exfiltrate data (including a Confluence API key) through an image-fetch request. Atlassian fixed the URL-parameter flaw server-side on July 8, 2026 per Bugcrowd (P2, $6,000 bounty), but the content-borne file-injection vector's status after PromptArmor's August 5, 2026 disclosure remains unconfirmed, with no CVE assigned to either issue.

thehackernews.comarticleAdded 26 Sep 2026🛡️ Security

CVE-2026-19978 describes an OS command injection (CWE-77/78) in jiantao88's android-mcp-server, where the child_process.exec call in build/index.js fails to sanitize the deviceId, packageName, permission, and extras[].key/value arguments used to control Android devices. The flaw allows local command execution and has a published exploit; it was fixed in commit 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a. CVSS 4.0 base score is 1.9 (local attack vector only), and the project uses rolling releases so no fixed version numbers are assigned.

nvd.nist.govadvisoryAdded 26 Sep 2026🛡️ Security

GitHub advisory GHSA-jh7p-qr78-84p7 for Claude Code: a malicious repository could ship a project settings file setting ANTHROPIC_BASE_URL to an attacker-controlled endpoint. Claude Code made API requests during project load before the trust prompt was shown, leaking data including the user's Anthropic API key. Fixed in auto-updated versions; manual updaters should upgrade. It is CVSS v4 scored, with network attack vector and passive user interaction, and mapped to a credential-transmission weakness (insecure transmission/storage of credentials).

github.comadvisoryAdded 26 Sep 2026🛡️ Security

GitHub advisory for @yoda.digital/gitlab-mcp-server (mcp-gitlab-server): with USE_SSE=true the HTTP/SSE transport has no authentication, sends wildcard CORS headers, and binds to 0.0.0.0. Any network caller or any web page the operator visits can open /sse and POST /messages to drive all 86 GitLab tools (delete_repository, push_files, etc.) using the operator's personal access token. It includes a curl PoC, a CVSS 4.0 vector (~6.3 Medium, effectively High when SSE is enabled) and four fixes: required auth token, loopback bind, a CORS allowlist, and the OAuth roadmap.

github.comadvisoryAdded 26 Sep 2026🛡️ Security

This paper identifies lifecycle-hook configuration updates as a trojan vector in AI agent harnesses: hooks bind shell commands to runtime events (session start, tool calls, file edits) and run with host privileges, but harnesses blindly trust plugin-metadata updates that silently rebind these commands to attacker-chosen code. The authors built HookPry, an open-source automated attack framework realizing ten attack objectives, and across 25 harness/backend combinations in 1,000 runs it compromised all seven evaluated harnesses (up to 92.5% per-harness success), while Microsoft Defender caught none of the malicious artifacts and combined static defenses still missed 47.5%.

arxiv.orgpaperAdded 26 Sep 2026🛡️ Security

This paper introduces QVec, a defense against Quantization-Conditioned Backdoors (QCBs) — a threat where a neural network behaves normally in full precision but activates hidden malicious behavior only after quantization. QVec treats the weight difference between the full-precision and quantized model as a "malicious task vector" (via task arithmetic) and applies a lightweight parameter correction before deployment to cancel it out, requiring no retraining, no trigger samples, and only one quantization pass plus a small hyperparameter search. It's evaluated across image classification benchmarks and multiple LLM backdoor attack scenarios, suppressing backdoor activation while preserving clean-model performance.

arxiv.orgpaperAdded 26 Sep 2026🛡️ Security

Minimally Invasive Steering Vector Optimization (MISVO) regularizes pre-logit activation steering using the local KL/Fisher geometry of the token distribution, letting a frozen model be adapted to a test-time reward without badly distorting its outputs. Across 1B-14B parameter models on preference and code-generation tasks, MISVO gets highest mean reward in six of seven settings while keeping diversity and coherence close to Best-of-N.

arxiv.orgpaperAdded 26 Sep 2026, published 24 Sep 2026🧠 AI

An Ethereum Magicians forum thread dissects a novel rug/bricking vector emerging from a launchpad (sender.family) that locks 100% of token supply forever into a single one-sided Uniswap v4 position, where the quote asset can be a KYC-gated tokenized stock (Ondo's NVDA/TSLA/AAPL tokens) rather than ETH or a stablecoin. Because Uniswap v4 routes all pool balances through a shared PoolManager singleton and pays swap/fee output to arbitrary addresses, the RWA issuer must permanently allowlist the PoolManager and any counterparty; if the issuer later tightens its transfer-registry rules, the permanently locked pool becomes irrecoverable with funds stuck inside. The author notes the launchpad's current mitigation is only an empirical point-in-time transfer test (moving a balance between two addresses) against an asset with an admin-controlled, stateful ERC-3643 canTransfer function, and asks whether there's any way to verify "transferable to arbitrary addresses" onchain before pool creation, and whether permanent lockers should categorically refuse upgradeable/pausable quote assets.

ethereum-magicians.orgthreadAdded 29 Sep 2026, published 24 Sep 2026🛡️ Security

PortSwigger researcher James Kettle built HTTP Terminator, an AI-assisted system (using Claude for extraction/test-case generation and Claude Code as an investigator agent) that ingested 138 HTTP/SMTP RFCs, split them into ~15,000 fragments, and generated 30,000 candidate HTTP desync vectors, testing them against authorized bug-bounty targets and finding ~700 vulnerable hosts. The research produced new desync triggers, a dual-matching Content-Length pattern, a "dangling-byte" technique to make response queue poisoning reliable, and the broader "Shared-Parser Confusion" concept, plus a separately human-guided discovery of a zero-day in Apache Traffic Server (CVE-2026-63078, unverified in public CVE/NVD records as of publication). PortSwigger has open-sourced HTTP Terminator, and separate researchers released public CRLF-desync tooling (crlf-desyncs, crlf-powered-desync-scanner).

thehackernews.comarticleAdded 24 Sep 2026🛡️ Security

A long-form explainer distinguishing attack surface from attack vector and asset inventory, breaking the surface into network/perimeter, identity/permissions, application/code, and data/storage components, and covering how to map it via the OWASP Attack Surface Analysis Cheat Sheet, measure it (Relative Attack Surface Quotient, Carnegie Mellon's attack surface metric), and reduce it. It also contrasts external attack surface management with cyber asset attack surface management and closes with a pitch for Orca's agentless SideScanning and Unified Data Model.

orca.securityarticlePublished and added 21 Sep 2026🛡️ Security

http-terminator is PortSwigger's AI-assisted research pipeline for finding and exploiting HTTP request-smuggling and response-desynchronization vulnerabilities. It chains four stages: seeker extracts desync vectors from RFCs and URLs, flamer generates malformed test cases, validator checks candidates against a live target via Burp Suite, and investigator exploits, confirms, and reports findings. Released under AGPL-3.0 as a reference companion to the underlying research, with explicit warnings to only run against authorized targets.

github.comrepoAdded 18 Sep 2026🛡️ Security

Cisco Talos's weekly Threat Source newsletter opens with commentary arguing that a slowdown in AI development would barely move the needle on cybersecurity, since models already uncover vulnerabilities effectively and defenders still neglect basics like asset inventory, least privilege, and network segmentation. The main threat-intel item covers Japan's ransomware landscape, where incidents rose nearly 5% in H1 2026, driven by "The Gentlemen" (a fast-growing RaaS group using the AdaptixC2 red-team framework for stealthy lateral movement) and "Qilin" (which uses LLMs to generate destructive scripts and speed up attacks), both hitting SMEs with double extortion. It closes with a roundup of other weekly stories: an Android banking-malware campaign abusing Google's Work Profile in Indonesia, Apple's ~200-vulnerability iOS/macOS patch batch, a ClickFix campaign via a compromised HBO Max Reddit account, and the $250/month VectraRAT implant.

blog.talosintelligence.comarticleAdded 7 Oct 2026, published 17 Sep 2026🛡️ Security

Endor Labs breaks down how the Exploit Prediction Scoring System (EPSS) v3 works — the exploitation telemetry, exploit-DB/GitHub/Metasploit code checks, CISA KEV/Project Zero/ZDI mentions, CVSS vectors, CWE, and social-media signals it ingests to score CVE exploitation likelihood — and shows that an EPSS-threshold (0.088) remediation strategy fixes the same share of exploited CVEs while patching only ~7.3% of known vulnerabilities versus ~82% under a "fix all high/critical" CVSS approach. It then explains a layered workflow: use reachability analysis (call-graph based) to cut findings by ~80% to what's actually exploitable in your environment, then apply EPSS on that reduced set to rank remaining issues by real-world exploitation likelihood, including for third-party/proprietary code where reachability analysis isn't feasible.

endorlabs.comarticlePublished and added 11 Sep 2026🛡️ Security

crypto-rag is an Indonesian-language CLI crypto assistant that pairs a static knowledge-base RAG pipeline with live market data tool calls, built on the principle that volatile numbers (price, funding rate, TVL, sentiment) must never be embedded in the vector store since they go stale instantly. It implements hybrid retrieval (BM25 keyword search + FAISS dense embeddings fused via Reciprocal Rank Fusion) over a 146-topic knowledge corpus, an optional cross-encoder reranker, and an intent router that dispatches price/derivatives/on-chain/sentiment queries to live sources (Binance, DefiLlama, Fear & Greed Index) versus concept questions to the corpus. A tool-calling agent handles multi-step queries, and an OpenAI-compatible LLM synthesis layer (works with StepFun, OpenAI, Groq, LM Studio, Ollama) grounds answers with citations and falls back to extractive answers when no LLM is configured.

github.comrepoAdded 2 Oct 2026, published 5 Sep 2026🧠 AI

funes is an open-source, single-binary memory layer that turns the session traces of coding agents (Claude Code, Codex, Pi, Hermes) into a durable, queryable memory instead of an unsearchable archive. It runs locally by default — chunking, embedding and reranking turns with a pinned local model into a Lance dataset, combining vector and BM25 search with cross-encoder reranking and recency weighting — and can optionally sync to a private-by-default Hugging Face dataset so a memory follows a user across machines or is shared across a team, with credential redaction before publishing. The post also reports a "handoff-vs-recall" benchmark showing recall from raw traces is cheaper and more reliable than context compaction or written handoffs for resuming long investigations.

huggingface.coarticleAdded 29 Sep 2026, published 3 Sep 2026🧠 AI

This arXiv paper formulates CNNs as a generalized index model with matrix-valued input, treating convolution filters as index vectors, and proposes an SVD-based estimator built on a generalized first-order Stein's formula to learn those filters directly rather than via gradient descent. The authors show the estimator achieves an optimal convergence rate comparable to generalized linear models with known link functions, and report that it outperforms standard deep learning optimizers like Adam in simulations and real-data experiments; they also note the method generalizes to nonlinear dimension reduction and representation learning.

arxiv.orgpaperAdded 22 Sep 2026, published 2 Sep 2026🧠 AI

osv-advisory-mcp-server is an MCP server that queries the OSV.dev vulnerability database, offering single-package version checks, batch audits of up to 1000 {name, ecosystem, version} tuples for SBOM/lockfile triage, and full advisory record fetch by OSV ID (GHSA/PYSEC/RUSTSEC/GO/DSA/DLA/CVE prefixes). It surfaces CVE aliases, CVSS vectors, derived severity labels, and CWE IDs, and is designed to chain into a companion nist-nvd-mcp-server for CVSS base scores, EPSS probability, and CISA KEV status. It ships as a keyless, no-API-key tool runnable via STDIO or Streamable HTTP, with a public hosted instance and Bun/npx/Docker install paths.

github.comrepoAdded 1 Sep 2026🛡️ Security

AnythingLLM is an open-source, MIT-licensed all-in-one LLM application from Mintplex Labs that lets users chat with their documents, run no-code AI agents, and connect to a wide range of LLM providers, embedders, vector databases, and TTS/STT services. It ships as a monorepo (frontend, server, collector, embed widget, browser extension) with multi-user permissioning, MCP compatibility, scheduled tasks, dynamic model routing, and both self-hosted (Docker) and desktop (Mac/Windows/Linux) deployment options.

github.comrepoAdded 23 Sep 2026, published 31 Aug 2026🧠 AI

A detailed Hugging Face blogpost on training and finetuning multi-vector (ColBERT-style late-interaction) embedding models using the new MultiVectorEncoder class in Sentence Transformers. It walks through model selection (finding that "-unsupervised" pre-supervised checkpoints adapt better to new domains than finished ones), dataset formatting, loss functions (CachedMultiVectorMultipleNegativesRankingLoss, MultiVectorDistillKLDivLoss), training arguments, and evaluators, then presents a full worked example finetuning mLateOn-medical on 1M MIRIAD medical question-passage pairs in 14.5 hours on a single RTX 3090, beating over 50 dense/sparse/lexical/multi-vector baselines by +0.062 NDCG@10. It closes with index optimization via HierarchicalTokenPooling and PLAID-style quantization (with Omar Khattab) showing a 13x storage reduction with minimal quality loss.

huggingface.coarticleAdded 29 Sep 2026, published 26 Aug 2026🧠 AI

Aikido Security tracks npm's Trusted Publishing (OIDC-based, short-lived credential) adoption over 18 months and shows it only spiked after each major supply-chain attack rather than from advisories or blog posts — jumping from a ~40/week baseline to 430/week after the Nx Console/AntV compromise, yet still leaving 40,369 of the top 51,370 packages (75% of download volume) on long-lived tokens. It chronicles the full attack progression from credential-phishing (Debug/Chalk, Axios) through Pwn Request-driven CI compromise (S1ngularity, Shai-Hulud 2.0) to the Mini Shai-Hulud II/TanStack attack, which poisoned the GitHub Actions cache to extract a live OIDC token from runner memory and publish packages with valid SLSA Build Level 3 provenance — proving Trusted Publishing itself can be turned into the attack vector rather than just bypassed. It closes by arguing the security community should proactively pressure high-download holdout maintainers rather than wait for the next worm.

aikido.devarticleAdded 3 Sep 2026, published 24 Aug 2026🛡️ Security

Splunk's August 2026 hardening advisory (SVD-2026-0808) discloses 17 CVEs across Cisco Talos Intelligence for Enterprise Security Cloud, Splunk AI Toolkit, Splunk Connect for Kafka, the Splunk MCP Server app, and Splunk On-Call (VictorOps). Notable issues include a critical (CVSS 9.1) RCE via unsafe credential deserialization in the Splunk MCP Server app (CVE-2026-76404), an RCE via pickle-based deserialization when loading ML model files in Splunk AI Toolkit (CVE-2026-76395), multiple SSRF and authorization-bypass flaws letting low-privileged users escalate to system-level search execution, hardcoded/predictable container credentials, and unauthenticated DoS/ReDoS and cert-validation bypasses in Splunk Connect for Kafka. Each finding includes CWE classification, CVSS vector, and mitigation guidance (typically disabling the affected app or restricting REST API access).

advisory.splunk.comadvisoryAdded 21 Aug 2026🛡️ Security

A Hugging Face engineering blog post detailing how Papers with Code built a hybrid search system combining PostgreSQL full-text search with pgvector-based dense retrieval, fused via reciprocal rank fusion (RRF). It walks through using Hugging Face Jobs for batch embedding of 110,000+ papers with Qwen3-Embedding-0.6B (using Matryoshka Representation Learning to shrink vectors to 256 dimensions), Storage Buckets as an immutable, checksummed handoff layer between database, compute, and production, and an authenticated Inference Endpoint (backed by Text Embeddings Inference) for low-latency query embedding with graceful fallback to lexical search on cold starts or failures.

huggingface.coarticleAdded 29 Sep 2026, published 21 Aug 2026🧠 AI

A blog post from AI-security firm Adversa AI cataloging ten zero-click attack vectors against AI agents — attacks that compromise an agent without requiring any user interaction, likely covering vectors such as malicious tool outputs, poisoned context/documents, or indirect prompt injection delivered via content the agent autonomously ingests. Adversa AI regularly publishes original research on LLM jailbreaks and agent security, making this a candidate reference for agentic-AI attack taxonomies.

adversa.aiarticleAdded 7 Oct 2026, published 18 Aug 2026🛡️ Security

0DIN (Mozilla's AI bug bounty program) announces it is expanding scope beyond inference-layer jailbreaks to agentic AI vulnerabilities — covering 29 products across coding agents, agentic browsers, enterprise agents, and general-purpose agents from OpenAI, Anthropic, Google, Microsoft, Salesforce, Amazon and others. It introduces a new evaluation rubric for agentic submissions (violation class, impact severity, attack vector, scope) mapped to the OWASP Top 10 for Agentic Applications, and raises the bar for inference jailbreaks by requiring retargetability across two JEF-tested boundaries. The post cites real incidents including a Cursor agent token exfiltration, a malicious GitHub MCP integration issue, a rogue MCP server leaking WhatsApp histories, and CVE-2025-68664 (LangGrinch) affecting 847M LangChain downloads.

0din.aiarticlePublished and added 15 Aug 2026🛡️ Security

Episode 17 of The OpenSourceMalware Show covers GitHub's move to revoke npm granular access tokens that could bypass 2FA, and follows up on the DPRK NullReceiver obfuscation technique (now found in well over the 7 originally confirmed packages, overlapping with the PolinRider campaign). The hosts also discuss why malicious AI 'skills' are hard to detect via static analysis due to their natural-language format, note DPRK's use of crypto payments (e.g. via Astrill VPN, hosting provider Evoxt) as a potential tracking vector for defenders, and touch on MCP server risk being more about vulnerabilities than outright malware.

opensourcemalware.comtalkAdded 3 Sep 2026, published 14 Aug 2026🛡️ Security

PortSwigger's Director of Research James Kettle built the HTTP Terminator, an autonomous system that automates his own research process (ideation, evaluation, weaponization, cascade) to invent novel HTTP attack techniques, extending his four years of HTTP desync research. The system parsed 138 technical specs into 15,000 inspiration fragments, generated 30,000 unique attack vectors, tested them against live bug-bounty targets, and confirmed roughly 700 vulnerable targets spanning government, financial, and enterprise infrastructure. Kettle found human intuition remained decisive at the "discovery cascade" stage where one finding seeds the next hypothesis, and he has released the HTTP Terminator's source code and a methodology blueprint alongside the full technical paper presented at Black Hat USA; PortSwigger contrasts it with its commercial Burp AT agent.

portswigger.netarticleAdded 21 Sep 2026, published 12 Aug 2026🛡️ Security

aurscan is a Go-based CLI that hooks into yay/paru to scan a downloaded AUR package's PKGBUILD, .install scriptlets, .SRCINFO and helper scripts before makepkg runs, blocking the build if it looks malicious. It combines offline, quote-aware static rules covering known AUR campaign signatures such as disguised source patch URLs, install-scriptlet worms, masqueraded binary file types, and editor auto-exec triggers with an LLM auditor (Claude Code, Codex, Anthropic API, or a local OpenAI-compatible model) that answers a fixed checklist of yes/no behavioral questions, from which aurscan deterministically derives a verdict, severity and confidence, and fails closed when no backend is available. It documents and defends against real incidents including the July 2025 firefox-patch-bin CHAOS RAT vector, the June 2026 Atomic Arch mass orphan-package takeover pulling a Rust stealer and eBPF rootkit, and the August 2026 xsnow dot-install worm that harvested SSH keys and self-propagated across AUR.

github.comrepoPublished and added 8 Aug 2026🛡️ Security

tl;dr sec #340 is a weekly security newsletter issue from Clint Gibler. It summarizes Figma's agentic code scanning (precision raised from 15% to 80%), AISI and Anthropic reports of AI agents attacking real third parties during cyber evaluations, Tailscale's analysis of the Hugging Face intrusion, and Datadog's coding-agent code execution paths. It also covers S3 clone gaps, S3 Vectors risks, HollowGraph and marimo IR notebooks.

tldrsec.comarticleAdded 30 Oct 2026, published 7 Aug 2026🛡️ Security

James Kettle (PortSwigger) built the "HTTP Terminator," an autonomous LLM-driven pipeline (Ideation → Evaluation → Weaponization → Cascade) that generated ~30,000 novel HTTP desync vectors from RFC micro-inspiration, tested them 24/7 across 30,000 live bug-bounty targets via a Burp Suite extension, and weaponized findings with an MCP-wired Turbo Intruder agent to achieve Response Queue Poisoning. The work yielded new desync triggers, a "dangling byte" RQP-reliability technique, a novel attack class ("Shared Parser Confusion"), a patched Apache Traffic Server zero-day (CVE-2026-63078), and confirmed impact on banks, an airport, a US government site, Meta, a Beyond Trust product, and an SSO server behind Citrix NetScaler. It also documents concrete prompt-engineering lessons (micro-inspiration, context-contamination, reality-reframing an over-cautious agent) for building autonomous AI security research systems.

portswigger.netwriteupAdded 18 Sep 2026, published 5 Aug 2026🛡️ Security

SecureAI-Scan is an offline CLI that performs import-resolved dataflow analysis on TypeScript, JavaScript, and Python code to find LLM/MCP/Agent-Skill/RAG-specific risks (prompt injection, tool poisoning, unsafe output handling, vector-store access control), mapped to the OWASP Top 10 for LLM Applications, Agentic Applications, and MCP Top 10. It distinguishes proven dataflow traces from heuristic keyword matches, scans .mcp.json/claude_desktop_config.json/SKILL.md for tool-poisoning and command-injection patterns (citing the WhatsApp MCP rug-pull and postmark-mcp backdoor), and includes evasion-resistant deobfuscation checks built in response to the "Cloak and Detonate" adversarial study (arXiv:2607.02357) that bypassed most published skill scanners. It also runs offline advisory checks against known-malicious/vulnerable packages (validated against CVE-2025-6514 and CVE-2024-34359) and integrates via GitHub Actions, pre-commit hooks, SARIF output, and an MCP server for Claude Code.

github.comrepoPublished and added 5 Aug 2026🛡️ Security

AgentHound is an open-source offensive security framework that, from a single compromised host, collects local credentials and agent configuration, discovers and fingerprints reachable AI services (MCP servers, A2A agents, model gateways, inference servers like Ollama, vector stores, MLOps platforms, notebooks), reuses harvested credentials to verify concrete access, and writes everything to a checkpointed JSON artifact. An optional analysis server (Neo4j/PostgreSQL-backed) turns the artifact into a queryable attack graph with credential-chain, cross-protocol pivot, exfiltration/execution paths, and prompt-injection-related findings (POISONED_INSTRUCTIONS, POISONED_DESCRIPTION, SHADOWS). It supports an active mode (credential reuse, differential reads, reversible mutation with auto-rollback) and a read-only --stealth mode for OPSEC-constrained engagements.

github.comrepoPublished and added 1 Aug 2026🛡️ Security

Huntress explains how initial access brokers (IABs) operate as specialized cybercriminals who breach organizations, verify and price the foothold, then sell it to ransomware crews, BEC actors, or data thieves via dark web marketplaces. It walks through common IAB entry vectors — infostealer credential theft, exposed RDP/VPN abuse, and AI-assisted phishing (citing a Huntress EvilTokens lure example) — and includes a real SOC case where a brute-forced RDP server led to tradecraft linked to a ransomware ecosystem. The piece closes with defensive recommendations (MFA, closing unused RDP, fast patching, security awareness training, identity anomaly monitoring) and notes why attributing follow-on breaches back to the original IAB sale is difficult due to time gaps between access sale and exploitation.

huntress.comarticleAdded 3 Sep 2026, published 21 Jul 2026🛡️ Security

Orca Security discloses CVE-2026-11386, a critical vulnerability in the Ubuntu Pro Client that reportedly allows root code execution on affected cloud instances. The fetched page content was empty, so this assessment is based on the title/URL alone; specifics on the vulnerable component, attack vector, and exploitation path are not confirmed here.

orca.securityadvisoryPublished and added 20 Jul 2026🛡️ Security

Jonex is an open-source enterprise AI knowledge platform that combines multimodal document/video parsing with an ontology-based knowledge compiler, indexing content into both a vector store (Milvus) and a knowledge graph (Neo4j) for source-grounded retrieval. It exposes ontology-first hybrid search APIs with reasoning traces and references, and integrates with LightRAG, RAG-Anything, and MinerU for graph-enhanced retrieval and document parsing, plus an MCP server for tool exposure.

github.comrepoAdded 2 Oct 2026, published 19 Jul 2026🧠 AI

This paper demonstrates that LM pretraining corpora can be poisoned at web scale by injecting malicious content through public discussion interfaces (e.g., comment sections), moving beyond prior work limited to editing Wikipedia. The authors introduce HalfLife, a novel analysis method for estimating whether adversarial content injected via such channels actually survives web crawling and data curation pipelines to end up in training data. The work establishes third-party webpage content/comments as a realistic attack vector for language model pretraining poisoning.

arxiv.orgpaperPublished and added 18 Jul 2026🛡️ Security

k8s-aibom is a Kubernetes controller from GoogleCloudPlatform that generates CycloneDX 1.6 ML-BOM documents at runtime for AI workloads — inference services (vLLM, TGI, Triton, Ollama), agent stacks (LangChain, AutoGen, CrewAI), RAG/vector DB infrastructure (Milvus, Qdrant, Weaviate), and training/eval jobs — by watching Kubernetes API objects with no privileged access. Each BOM attribute carries a declared/inferred/unresolved confidence flag and evidence locator, and the project positions its output as auditor-traceable evidence for EU AI Act Article 12/50, NIST AI RMF, and ISO/IEC 42001 compliance, with redaction filters, immutable GCS write-once sinks, and Sigstore-signed release attestations.

github.comrepoPublished and added 18 Jul 2026🛡️ Security

OpenSourceMalware's July hunt update on the PolinRider campaign (a Lazarus Group/DPRK operation linked to Contagious Interview and TasksJacker) found 2,417 newly-compromised GitHub repos, bringing the confirmed footprint to 4,367 repos across 2,152 owners — a 6.5x increase since March. The post breaks down the two injection vectors (94% config-file injection into files like postcss.config.mjs/tailwind.config.js/eslint.config.mjs, 6% payloads hidden in a .woff2 font file), shows the campaign overwhelmingly hits individual developer accounts rather than orgs, and republishes updated signature markers, decoder function names, and grep-based detection/remediation steps.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 15 Jul 2026🛡️ Security

Orca Security writeup covering CVE-2026-48282, a maximum-severity remote code execution vulnerability in Adobe ColdFusion. The page content could not be retrieved, so technical details (root cause, exploitation vector, affected versions) are unconfirmed beyond the title.

orca.securityadvisoryPublished and added 15 Jul 2026🛡️ Security

GitHub repo by Kai Greshake collecting research and proof-of-concept material on LLM security, notably indirect prompt injection attacks where malicious instructions are embedded in retrieved content (web pages, documents) to hijack LLM-integrated applications like Bing Chat. It underpins some of the earliest published demonstrations of prompt injection as a practical attack vector against production AI assistants.

github.comrepoAdded 3 Sep 2026, published 14 Jul 2026🛡️ Security

ai-surface is a local/offline static analysis CLI (apisec-inc) that scans a codebase for AI attack surface — LLM SDK calls, agent frameworks (LangChain, AWS Strands), MCP servers, RAG/vector stores, model gateways, and provider keys — and flags risk indicators such as financial-action tools with no human approval or unverified MCP servers. It generates an AI-BOM (CycloneDX), SARIF for GitHub code scanning, and maps findings to OWASP LLM Top 10, EU AI Act, NIST AI RMF, and ISO/IEC 42001, with a baseline+fail-on-severity workflow for gating new risk in PRs without blocking on pre-existing debt.

github.comrepoPublished and added 11 Jul 2026🛡️ Security